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1. INTRODUCTION 

Over the past few decades, researchers have attempted to establish the factors influencing 
technology adoption. There are several different theories and models to research the process of adopting new 
technologies introduced. The major theories used in this field are the diffusion of innovations (DOD [1], the 
technology-organisation-environment (TOE) framework [2], the theory of reasoned action (TRA) [3], the 
technology acceptance model (TAM) [4], the technology acceptance model 2 (TAM2) [5], the technology 
acceptance model 3 (TAM3) [6], unified theory of acceptance and use of technology (UTAUT) [7] and 
unified theory of acceptance and use of technology 2 (UTAUTZ2) [8]. 

Among these theories, DOI, TOE, TAM3 and UTAUT2 are the most widely used theories which 
attempt to explain and forecast cloud computing adoption. Most of these theories describe and predict the 
decision to an adoption based on technology factors themselves. In addition to the adoption models, 
information security is used to validate the security adoption in cloud computing. 

Ismail [9], Naresh and Bharathi [10] and Zaballos and Rodriguez [11], there are several 
opportunities created by the adoption of cloud computing, whereas [12]-[15] emphasise the risks associated 
with the adoption of cloud computing. [10], [11], [16], [17] indicated enterprises’ challenges when cloud 
adoption was made. Further, [18] describe the information security responsibilities when cloud computing 
was adopted. Also, the researchers [19]-[25] identified that information security influences cloud computing 
adoption. Behavioural Intention is the strong mediating factor identified by many research [5]-[8], [23]-[27] 
that mediate the adoption of cloud computing with all independent variables. 

Table 1 summarises the adoption frameworks or models that relate the significant factors that 
influence cloud computing adoption with the recent references. Opportunities is an independent factor that 
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comprises five dimensions: Relative advantage, price value, performance expectancy, effort expectancy and 
hedonic motivation. Risks is an independent factor that comprises four dimensions: output quality, 
performance of external control, compatibility and complexity. Challenges is an independent factor that 
comprises three dimensions: top management support, technology readiness and government regulations. 
Information security is another independent factor, and behavioural intention is the mediating factor which 
mediates the the relationship between independent factors and the dependent factor: Adoption of cloud 
computing. 

The main objective of this study is to design a secure cloud adoption model (SCAM). The findings 
from previous researches and existing technology adoption frameworks and models were summarised in the 
Table 1. These findings are supported for modelling the SCAM. 


Table 1. Factors of adoption of cloud computing 


Framework/ Opportunities Risks Referen 
Model Relative Price Performa Effort Hedonic Output Perception Compa Comple ces 
Advanta Value nce Expectan Motivati Quality of external tibility xity 
ge Expectan cy on control 
cy 
TOE, DOI v v 28 
TOE, DOI, v v v v 19 
UTAUT2 
TOE, DOI v v v 20] 
TOE, DOI v v v 29] 
TOE, DOI, v v v 21 
UTAUT2 
UTAUT2 v 22 
UTAUT2 v v v v 25 
UTAUT2 v v v v 26] 
UTAUT2 v v v 27] 
UTAUT2 v v v v 24 
UTAUT2 v v v 23] 
TAM3 v v 30] 
TAM3 v v 31 
TAM3 v v 32] 
DOI, TOE v 33 
Total 4 7 5 5 4 3 3 5 5 
Framework/M Challenges Other factors Referen 
odel Top Technology Government Information Security Behavioural ces 
manage Readiness Regulations Intention 
ment 
support 
TOE, DOI v v v 28] 
TOE, DOI, v v v v 19 
UTAUT2 
TOE, DOI v v v v 20] 
TOE, DOI v v 29 
TOE, DOI, v v v 21 
UTAUT2 
UTAUT2 v 22 
UTAUT2 v v 25 
UTAUT2 v 26] 
UTAUT2 v 27 
UTAUT2 v v 24 
UTAUT2 v v 23 
TAM3 30 
TAM3 31 
TAM3 32 
DOI, TOE v 33 
Total 5 3 5 7 6 


v- Significant factor that influences the adoption of cloud computing 
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2. THE COMPREHENSIVE THEORETICAL BASIS 

The study extensively reviewed technological adoption models such as DOI, TOE framework, TAM3, 
and UTAUT2 to draw a theoretical foundation for evaluating the novel reference model. The theory of 
Diffusion of innovation (DOI) [1] was initially developed in 1962 by Roger and is still in use for adoption, 
leading to technological innovation. The theory defines the factors that influence the diffusion of emerging 
technologies or perceptions in a society [1]. Roger identified that innovation is consists of five key factors: 
"relative advantage, compatibility, complexity, trialability and observability" [1]. Among these five factors, the 
most impactful on adopting different innovations are relative advantage, complexity, and compatibility [34]. 

Tornatzky and Fleischer [2] developed the technology organisation environment (TOE) framework. 
They identified three factors that affect adopting and implementing technological innovation in an 
organisation: technological, organisational and environmental. Within the technology factor, they identified 
relative advantage, uncertainty, compatibility, complexity, and trialability are dimensions. The Organisation 
factor comprises the behaviour of top management, organisational structure and communication as 
dimensions. Competitors, government regulations, industry characteristics and market scope are identified as 
the dimensions of the Environment factor. Many recent studies [35]-[39] used the TOE framework. Among 
the factors, relative advantage, compatibility, complexity, the behaviour of top management and government 
regulations are adopted for SCAM model. 

Technology acceptance model 3 (TAM3) is given by Venkatesh and Bala [6] based on the impact of 
information technology (IT) adoption and effective usage strategies. The model combines TAM2 by 
Venkatesh and Davis [5] and the model of determinants of perceived ease of use by Venkatesh [40]. TAM 3 
model comprised of the following factors; "Perceived usefulness, perceived ease of use, subjective norm, 
image, job relevance, output quality, result demonstrability, computer self-efficacy, perception of external 
control, computer anxiety, computer playfulness, perceived enjoyment, objective usability, experience, 
voluntariness and behavioural intention" [6]. Among the factors, output quality, perception of external 
control and behavioural intention are adopted for the SCAM model. 

Theory of acceptance and use of technology 2 (UTAUT2) model is proposed by Venkatesh et al. 
[8]; it is the second iteration of UTAUT proposed by Venkatesh et al. [7] by adding additional factors that 
influence the technology use acceptance. UTAUT2 comprises the following factors; "Performance 
expectancy, effort expectancy, social influence, facilitating conditions, hedonic motivation, price value, habit, 
awareness, behavioural intention and use behaviour" [8]. From these factors, performance expectancy, effort 
expectancy and behavioural intention are adopted to form the SCAM model. 


3. RESEARCH METHOD 

The study mainly focuses on designing a secure cloud adoption model (Figure 1), especially for SMEs 
in the IT sector. The novel reference model incorporated by evaluating with four majour technology adoption 
theories that are Rogers' DOI [1], TOE framework [2], Venkatesh and Bala's TAM3 [6], and Venkatesh, 
Thong, and Xu's UTAUT2 [8]. As per the literature review and the tests conducted among the Sri Lankan 
information technology industry SMEs in this study, it is identified that there are four independent variables 
for making a secure model for cloud adoption that are Opportunities, risks, challenges and information 
security. Twelve (12) dimensional variables were identified for these three independent variables as tabled in 
Table 2. In addition to that, a mediating variable, Behavioural Intention and a dependent variable, adoption of 
cloud computing, were identified. 

A conceptual framework for this research was developed based on the identified variables used to 
study the adoption of cloud computing in the IT industry SMEs. Research findings indicated that the DOI, 
TOE, TAM3 and UTAUT2 were used to prepare a mapping to develop the conceptual framework. Table 2 
provides the mapping of the SCAM. The mapping detailed each dimension derived from the adoption models 
and where they have been used in recent studies. 

Further, nine (9) hypothetical relationships are formed based on the literature and summarised in 
Table 3. Two hundred and fifty-six (256) information technology (IT) organisations in Sri Lanka participated 
in the survey to test the hypothesis. Data was gathered from the key officials from the organisations. The 
study used quantitative methods for collecting data using a pre-structured questionnaire. The collected data is 
coded and analysed with SPSS software version 27, and the reliability of the collected data is checked using 
Cron batches alpha. Also, the cloud usage factors such as cloud service models and deployment models were 
analysed. To obtain the model fit of the conceptual model, AMOS software version 28 is used, and results are 
generated. 


Indonesian J Elec Eng & Comp Sci, Vol. 27, No. 2, August 2022: 936-943 


Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 o 939 


Table 2. Mapping the factors/dimensions in SCAM 


Initial Factors of Secure Cloud Supported by Previous Supported by recent 
Adoption Model (SCAM) Technology Adoption literature. 
Models 
Opportunities (OPP) [9]-[11] 
- Relative Advantage TOE [2] , DOI [1] [19], [20], [28], [29] 
- Price Value UTAUT?2 [8] [19], [21], [22], [23]- 
[27] 
- Performance Expectancy UTAUT?2 [8] [23]-[27] 
- Effort Expectancy UTAUT?2 [8] [23]-[27] 
- Hedonic Motivation UTAUT?2 [8] [23]-[26] 
Risks (RSK) [12]-[15] 
- Output Quality TAM3 [6] [30]-[32] 
- Perception of external control TAM3 [6] [30]-[32] 
- Compatibility TOE [2], DOI [1] [19]-[21], [28], [29] 
- Complexity TOE [2], DOI [1] [19]-[21], [29], [33] 
Challenges (CHL) [10], [11], [16], [17] 
- Top management support TOE [2] [19]-[21], [28], [29] 
- Technology Readiness TOE [2] [19], [20], [28] 
- Government Regulations TOE [2] [19]-[21], [28], [29] 
Information Security (IS) [19]-[25] 
Behavioural Intention (BD UTAUT?2 [8], TAM3 [5]-[8], [23]-[27] 


[6] 


Table 3. Research hypothesis 


Hypothesis Relationship 
H1 There is a significant relationship between Opportunities and Behavioural Intention 
H2 There is a significant relationship between Risk and Behavioural Intention 
H3 There is a significant relationship between Challenges and Behavioural Intention 
H4 There is a significant relationship between Information Security and Behavioural Intention 
H5 There is a significant relationship between Behavioural Intention and Adoption of Cloud Computing 
H6 There is a significant relationship between Opportunities and Adoption of Cloud Computing 
H7 There is a significant relationship between Risk and Adoption of Cloud Computing 
H8 There is a significant relationship between Challenges and Adoption of Cloud Computing 
H9 There is a significant relationship between Information Security and Adoption of Cloud Computing 
H10 Behavioural Intention mediates opportunities towards the Adoption of Cloud Computing 
H11 Behavioural Intention mediates risk towards the Adoption of Cloud Computing 
H12 Behavioural Intention mediates challenges towards the Adoption of Cloud Computing 
H13 Behavioural Intention mediates information Security towards the Adoption of Cloud Computing 


3.1. Secure cloud adoption model (SCAM) 

The secure cloud adoption model depicted in Figure 1 was developed in response to the literature 
review, current technological adoption models, and survey results as discussed. Hypothesis H1, H2, H3 and 
H4 are used to check the relationship between independent variables opportunities, risks, challenges and 
information security to mediating variable behavioural intention. Hypothesis H5 is used to check the 
relationship between mediating variable behavioural intention and dependent variable adoption of cloud 
computing. Hypothesis H6, H7, H8 and H9 are used to check the relationship between independent variables 
opportunities, risks, challenges and information security to dependent variable adoption of cloud computing. 
Further, Hypothesis H10, H11, H12 and H13 are used to check mediating relationships. 

The conceptual framework represents the relationship between this study's independent, dependent, 
and mediating variables. The secure cloud adoption model comprises four (4) independent variables, 
including twelve (12) dimensions, one (1) mediatory variable that influences the dependent variable of 
adoption of cloud computing in the IT organisation in Sri Lanka for Secure Cloud Adoption as shown in 
Figure 1. The independent variables were opportunities, risks, challenges and information security. The 
dimensions such as relative advantage, price value, performance expectancy, effort expectancy and hedonic 
motivation are classified under the independent variable of opportunities. The dimensions such as output 
quality, perception of external control, compatibility and complexity are classified under the independent 
variable risks. The dimensions such as top management support, technology readiness and government 
regulations are classified under the independent variable challenges. Further, the variable Information 
Security is an additional independent variable identified. The variable behavioural intention is identified as a 
mediating variable towards the dependent variable, adoption of cloud computing. 
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Figure 1. Secure cloud adoption model (SCAM) 


RESULTS AND DISCUSSION 
SCAM model tested hypothetically. The test was conducted among SMEs in the Sri Lankan 


information technology industry. Initially exploratory factor analysis was performed with SPSS. Then 
validity and reliability of the results checked. Finally confirmatory factor analysis with AMOS performed 
and the results generated as mentioned in the Table 4. 


Table 4. Results of hypothesis testing 


Hypothesis with direction P-value (p<0.05) Estimate value Findings 
H1: OPP >BI 0.000 0.217 Accepted 
H2: RSK DBI 0.000 0.422 Accepted 
H3: CHL >BI 0.000 0.585 Accepted 
H4: IS > BI 0.005 0.152 Accepted 
H5: BI > ACC 0.000 0.501 Accepted 
H6: OPP > ACC 0.000 0.371 Accepted 
H7: RSK > ACC 0.942 0.004 Rejected 
H8: CHL > ACC 0.000 0.337 Accepted 
H9: IS > ACC 0.919 0.004 Rejected 
H10: OPP >BI> ACC 0.010 0.109 Accepted and Partial Mediation 
H11: RSK >BI> ACC 0.944 0.211 Rejected 
H12: CHL >BI> ACC 0.020 0.293 Accepted and Partial Mediation 
H13: IS > BI> ACC 0.990 0.076 Rejected 


Hypothesis 1 is accepted: The strength of the relationship between opportunities and behavioural 
Intention is +0.217, and the p-value is statistically significant. Hence, it could be concluded that the 
opportunities are significantly and positively correlated with the intent to adopt cloud computing among 
IT industry SMEs in Sri Lanka. 

Hypothesis 2 is accepted: The strength of the relationship between risks and behavioural Intention is 
+0.422, and the p-value is statistically significant. Hence, it could be concluded that the risks are 
significantly and positively correlated with adopting cloud computing among IT industry SMEs in Sri 
Lanka. 

Hypothesis 3 is accepted: The strength of the relationship between challenges and behavioural Intention 
is +0.585, and the p-value is statistically significant. Hence, it could be concluded that the challenges 
are significantly and positively correlated with adopting cloud computing among IT industry SMEs in 
Sri Lanka. 
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- Hypothesis 4 is accepted: The strength of the relationship between Information Security and 
behavioural Intention is +0.152, and the p-value is statistically significant. Hence, it could be concluded 
that Information Security is significantly and positively correlated with the intent to adopt cloud 
computing among IT industry SMEs in Sri Lanka. 

- Hypothesis 5 is accepted: The strength of the relationship between behavioural Intention and adoption 
of cloud computing is +0.501, and the p-value is statistically significant. Hence, it could be concluded 
that Behavioural Intention is significantly and positively correlated with the adoption of cloud 
computing among IT industry SMEs in Sri Lanka. 

- Hypothesis 6 is accepted: The strength of the relationship between opportunities and adoption of cloud 
computing is +0.371, and the p-value is statistically significant. Hence, it could be concluded that 
behavioural Intention is significantly and positively correlated with the adoption of cloud computing 
among IT industry SMEs in Sri Lanka. 

- Hypothesis 7 is rejected: The strength of the relationship between risks and adoption of cloud 
computing is +0.004, and the p-value is statistically not significant. Hence, it could be concluded that 
risk is not correlated with the adoption of cloud computing among IT industry SMEs in Sri Lanka. 

- Hypothesis 8 is accepted: The strength of the relationship between challenges and adoption of cloud 
computing is +0.337, and the p-value is statistically significant. Hence, it could be concluded that 
challenges is significantly and positively correlated with the adoption of cloud computing among IT 
industry SMEs in Sri Lanka. 

- Hypothesis 9 is rejected: The strength of the relationship between opportunities and adoption of cloud 
computing is +0.004, and the p-value is not statistically significant. Hence, it could be concluded that 
Information security is not correlated with the adoption of cloud computing among IT industry SMEs in 
Sri Lanka. 

- Hypothesis 10 is accepted: The strength of the relationship between opportunities and adoption of cloud 
computing is mediated by behavioural Intention. The strength is lower (+0.109) and the p-value is 
statistically significant. Hence, it could be concluded that the effect of opportunities on the adoption of 
cloud computing is partially mediated by behavioural Intention among IT industry SMEs in Sri Lanka. 

- Hypothesis 11 is rejected: The relationship between risks and adoption of cloud computing is mediated 
by behavioural Intention is not statistically significant. Hence, it could be concluded that the effect of 
risks on the adoption of cloud computing is not mediated by behavioural Intention among IT industry 
SMEs in Sri Lanka. 

- Hypothesis 12 is accepted: The strength of the relationship between challenges and adoption of cloud 
computing is mediated by behavioural Intention. The strength is +0.293 and the p-value is statistically 
significant. Hence, it could be concluded that the effect of challenges on the adoption of cloud 
computing is partially mediated by behavioural Intention among IT industry SMEs in Sri Lanka. 

- Hypothesis 13 is rejected: The relationship between Information Security and adoption of cloud 
computing is mediated by behavioural Intention is not statistically significant. Hence, it could be 
concluded that the effect of Information Security on the adoption of cloud computing is not mediated by 
behavioural Intention among IT industry SMEs in Sri Lanka. 


5. CONCLUSION 

The secure cloud adoption model can be used for decision-makers to adopt the cloud computing 
infrastructure to their organisation with the concern of the opportunities (benefits) that they will gain, risks of 
adoption whether its complete migration, partial migration or slow migration to cloud from the traditional 
computing, challenges they will face by adding new infrastructure to their business and the security 
protection of their information by adding their data in the cloud. According to the survey results, the world is 
moving towards cloud computing, and several organisations partially adopted and planning to adopt it in the 
future. The SCAM model indeed benefits anyone who wishes to migrate into the cloud. 
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